CVE-2024-27130: QNAP QTS and QuTS hero NAS Buffer Overflow Remote Code Execution

CVE-2024-27130 is a high-severity buffer-copy vulnerability (CWE-120, buffer copy without checking size of input, and CWE-121, stack-based buffer overflow) in QNAP's QTS and QuTS hero network-attached storage operating systems: QNAP's own advisory states that a remote attacker who has already obtained user-level access to the device could exploit the flaw to execute arbitrary code, and NVD has published its own Primary CVSS v3.1 score of 8.8 (high) for the issue.

CVE-2024-27130 (CWE-120, CWE-121) affects QNAP's QTS and QuTS hero network-attached storage (NAS) operating systems. NVD's description states: "A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute code via a network" (NVD).

QNAP's own security advisory QSA-24-23, "Multiple Vulnerabilities in QTS and QuTS hero," is more specific about the attack prerequisite, stating that "remote attackers who have obtained user-level access could potentially execute arbitrary code on the affected system" — meaning the attacker needs some level of prior access to the NAS before this flaw can be used to escalate to code execution (QNAP QSA-24-23). QNAP credits Aliz Hammond of watchTowr Labs with reporting the issue, rates its own severity as "Moderate," and lists the issue as resolved in QTS 5.1.7.2770 (build 20240520) and QuTS hero h5.1.7.2770 (build 20240520) and later (QNAP QSA-24-23).

NVD lists the CVE's status as "Modified" with its own Primary CVSS v3.1 base score of 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — the PR:L (privileges required: low) component of NVD's vector lines up with QNAP's description of an attacker who already has user-level access. QNAP separately submitted its own Secondary CVSS v3.1 score of 7.2, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L — a different vector and a full point lower than NVD's own analysis (NVD).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, but FIRST scores the probability of exploitation at 0.3752 (98.5th percentile) as of 2026-11-07 — an unusually high EPSS score for a flaw with no confirmed in-the-wild exploitation, reflecting how attractive internet-exposed NAS devices are as a target class (CISA KEV, FIRST EPSS).

Any QNAP NAS running QTS 5.1.x or QuTS hero h5.1.x older than the May 2024 build should be updated to the fixed build listed in QSA-24-23, and QNAP devices generally should not be directly exposed to the internet without a VPN or similar access control, since this flaw (like many NAS vulnerabilities) assumes an attacker can already reach the management interface.

• A buffer copy without checking size of input vulnerability affects several QNAP operating system versions; if exploited, it could allow users to execute code via a network. Fixed in QTS 5.1.7.2770 build 20240520 and QuTS hero h5.1.7.2770 build 20240520 and later. — NVD
• Remote attackers who have obtained user-level access could potentially execute arbitrary code on the affected system; reported by Aliz Hammond of watchTowr Labs; QNAP rates its own severity as Moderate and lists the issue as resolved. — QNAP Security Advisory QSA-24-23
• NVD status 'Modified'; NVD Primary CVSS v3.1 base score 8.8, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. QNAP's own Secondary CVSS v3.1 score is 7.2, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L. — NVD
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.3752 (98.5th percentile) as of 2026-11-07. — FIRST EPSS